sng app

Beta

Being rolled out. The interface described here is the one of the next release: it may still change, and may not be enabled on your tenant yet.

sng app drives the container Apps of your tenant (kind App). Each command that changes something rewrites the App's manifest on the platform side; the deployment follows, and sng app describe lets you watch it. All commands require a session (sng sso login), a and a tenant (sng tenant use).

Not to be confused with sng iam app, which lists your users' OIDC applications.

App names are DNS labels of at most 24 characters (^[a-z](./[-a-z0-9]{0,22}[a-z0-9])?$). The global flags (--config, --json, -v, --version) are described on the CLI home page.

sng app list

sng app list

Lists the Apps of the current tenant with their deployed state.

No arguments, no flags of its own.

sng app list

NAME   STATUS      SERVICES  URL
shop   prête       4/4       https://api-shop.<tenant>.dev.stackngo.app/
web    en attente  -         -

Column	Content
STATUS	en attente (state not reported yet), prête, en cours, or the blocking reason (QuotaExceeded, SecretNotFound…)
SERVICES	ready services / total, - if unknown
URL	URL of the first exposed service, - otherwise

--json output:

{
  "apps": [
    {
      "name": "shop",
      "ready": true,
      "synced": true,
      "summary": "4/4",
      "reason": "Reconciled",
      "services": [
        { "name": "api", "kind": "deployment", "image": "registry.gitlab.com/stackngo/shop-api:1.4.2",
          "size": "xs", "replicas": 2, "ready": true, "phase": "Ready", "reason": "Reconciled",
          "message": "2/2 prêts", "url": "https://api-shop.<tenant>.dev.stackngo.app/" }
      ]
    }
  ]
}

Without Apps: aucune App.

sng app create

sng app create NAME --image IMAGE [flags]

Creates an App with a single service, named like the App, without writing a manifest. For several services, write the manifest (sng template gen App) and sng apply.

Argument	Description
NAME	name of the App and of its service

Flag	Type	Default	Description
--image	string	—	container image (required)
--port	list	—	exposed port, "8080" or "80:8080"; repeatable or comma-separated
--ingress[=PORT]	optional	—	exposes over HTTPS at https://NAME-NAME.<tenant>.dev.stackngo.app/; --ingress=8080 chooses the port
--size	string	xxs	size: xxxs xxs xs s m l xl xxl xxxl
--replicas	integer	1	number of replicas (written only if the flag is given)
--user	string	—	numeric non-root uid, "uid" or "uid:gid"
--env	K=V	—	environment variable; repeatable (not split on commas)
--env-secret	K=SECRET:CLÉ	—	variable taken from a Secret key; repeatable
--env-from	list	—	Secret whose keys all become variables; repeatable
--image-pull-secret	list	—	docker-registry Secret; repeatable
--egress-internet	boolean	false	allows outbound traffic to the Internet
--allow-from	list	—	another App of the tenant allowed on the ports; repeatable

sng app create web --image nginxinc/nginx-unprivileged:1.27 --port 8080 --ingress
sng app create api --image registry/api:1.2 --port 8080 --size s \
  --env LOG=info --env-secret DB_PASSWORD=db:password --egress-internet
sng app create db --image postgres:17 --user 999 --port 5432 --env-secret POSTGRES_PASSWORD=db:password

App "web" créée ; déploiement en cours (sng app describe web)

--json returns the App as sng app describe shows it (without a deployed state yet).

Error	Cause
--image requis	flag missing
nom d'App invalide "Shop" : minuscules, chiffres et '-', 24 caractères au plus	name not in the expected format
--ingress="x" : port attendu	non-numeric value
--env "FOO" : forme K=V attendue	no =
--env-secret "DB=db" : forme K=SECRET:CLÉ attendue	no : between the Secret and the key
l'App "web" existe déjà (sng app patch)	an App with this name exists: modify it
services.web : ingress sans port (déclarer ports)	--ingress without --port
spec.services.web.size: Unsupported value: "xxxxl"	value rejected by the schema

sng app describe

sng app describe NAME [--manifest]

Shows the state of the App and of each of its services: kind, image, phase, URL, reason, and message.

Argument	Description
NAME	name of the App

Flag	Type	Default	Description
--manifest	boolean	false	also shows the current manifest after the table

sng app describe shop
sng app describe shop --manifest

App      : shop
Statut   : en cours
Message  : api : attend : migrate
SERVICE  KIND        IMAGE                                        PHASE        URL  DETAIL
api      deployment  registry.gitlab.com/stackngo/shop-api:1.4.2  Waiting      -    WaitingForDependency attend : migrate
db       deployment  postgres:17                                  Ready        -    Reconciled 1/1 prêts
migrate  job         registry.gitlab.com/stackngo/shop-api:1.4.2  Progressing  -    JobRunning job en cours

Message only appears if the App has one. --json returns the App object (see list), with the additional manifest field (YAML).

Error	Cause
shop	no App with this name in the current tenant (the message only contains the name)

sng app patch

sng app patch NAME [--service SERVICE] [flags]

Modifies one service of the App. Fields not given stay unchanged.

Argument	Description
NAME	name of the App

Flag	Type	Default	Description
--service	string	the single service	targeted service; required if the App has several
--image	string	—	new image
--size	string	—	new size
--replicas	integer	—	number of replicas (written only if the flag is given)
--port	list	—	replaces the list of ports; repeatable
--ingress-port	integer	—	ingress port; 0 removes the ingress
--env	K=V	—	adds or changes a variable; repeatable
--env-secret	K=SECRET:CLÉ	—	adds a variable taken from a Secret; repeatable
--unset-env	list	—	removes a variable; repeatable
--egress-internet	boolean	—	true opens, false closes outbound Internet access (written only if given)
--allow-from	list	—	replaces the allowed Apps; '' for none

sng app patch web --image nginxinc/nginx-unprivileged:1.27-alpine
sng app patch shop --service api --size s --env LOG=debug --unset-env OLD
sng app patch shop --service api --ingress-port 0
sng app patch shop --service db --allow-from reporting,bi

App "shop" modifiée ; déploiement en cours

Error	Cause
plusieurs services : préciser --service (api, db, migrate)	App with several services without --service
service "web" absent (api, db)	unknown --service
spec.services.db: Invalid value: … un service avec volume tourne en un seul exemplaire …	the result breaks a schema rule (here --replicas 2 on a service with a volume); nothing is written
shop	unknown App

sng app scale

sng app scale NAME REPLICAS [--service SERVICE]

Sets the number of replicas of a deployment service.

Argument	Description
NAME	name of the App
REPLICAS	integer from 0 to 100; 0 stops the instances without deleting the service

Flag	Type	Default	Description
--service	string	the single service	targeted service

sng app scale web 2
sng app scale shop 3 --service api

App "shop" : 3 réplica(s) demandé(s)

Error	Cause
REPLICAS "abc" : entier positif attendu	non-numeric or negative argument
replicas 150 hors de 0-100	out of bounds
scale ne s'applique qu'à un deployment (kind job)	job or cronjob service
le service est en autoscale : modifier autoscale.max plutôt que replicas	service with autoscale
un service avec volume tourne en un seul exemplaire	REPLICAS > 1 on a service with a volume

sng app restart

sng app restart NAME [--service SERVICE]

Restarts the instances: all the App's deployment services, or only one with --service. Instances are replaced according to the service's strategy; nothing else changes.

Argument	Description
NAME	name of the App

Flag	Type	Default	Description
--service	string	all deployments	targeted service

sng app restart shop
sng app restart shop --service api

App "shop" : redémarrage demandé

Error	Cause
restart ne s'applique qu'à un deployment (kind job)	--service on a job or a cronjob
aucun deployment à redémarrer	the App only has jobs/cronjobs

sng app logs

sng app logs NAME [--service SERVICE] [--tail N] [--since DURÉE] [-f]

Shows the logs of the App's instances, each line prefixed with the instance name ([instance], or [instance/conteneur] when it has several, for example with init).

Argument	Description
NAME	name of the App

Flag	Type	Default	Description
--service	string	all	only read the instances of this service
--tail	integer	200	last lines per container; capped at 5000
--since	duration	—	only read from this duration back (10m, 2h); capped at 24h
-f, --follow	boolean	false	follows the stream; cut off after 10 minutes

sng app logs web
sng app logs shop --service api --since 10m -f
sng app logs shop --service migrate --tail 50

[shop-api-7c9d4b8f6-x2k9q] 2026-10-07T09:12:03Z INFO listening on :8080
[shop-migrate-a1b2c3d4-zz9pq] migrate ok

The output is plain text; --json has no effect. A read never exceeds 10 MiB. Without a running instance: aucun … pour l'App shop.

Error	Cause
shop	unknown App
service "Api" invalide	service name not in the expected format
forbidden (no policy of this tenant allows it: see sng tenant policy list)	no deploy:logs right on this App

sng app delete

sng app delete NAME [-y|--yes]

Deletes the App: its services, its addresses, and its network disappear. The volumes are kept with their data.

Argument	Description
NAME	name of the App

Flag	Type	Default	Description
-y, --yes	boolean	false	confirms without a prompt; required outside an interactive terminal

sng app delete web
sng app delete web --yes

Supprimer l'App "web" ?
Tapez « oui » pour confirmer : oui
App "web" supprimée (les volumes restent)

--json: {"name": "web", "deleted": true}. Equivalent: sng kind delete App web.

Error	Cause
confirmation requise : relancez avec --yes ou depuis un terminal interactif	non-interactive standard input without --yes
opération annulée	answer other than oui/o/yes/y
web	unknown App

Related commands

Command	Role
sng template gen App [NAME]	writes an example App manifest (<name>.yml) to complete
sng apply FICHIER	applies an App manifest (creation or full update)
sng validate FICHIER, sng plan FICHIER	check and preview before apply
sng kind get App NAME	raw manifest as saved
sng kind list App	Apps of the tenant, without deployed state
sng kind delete App NAME	same effect as sng app delete

Errors common to all commands

Error	Cause
tenant session required: run sng tenant use NAME	no current tenant
session expired: run sng tenant use NAME (or sng sso login if identity is expired)	session or identity expired: sng tenant use, otherwise sng sso login
forbidden (no policy of this tenant allows it: see sng tenant policy list)	your tenant's policy does not grant you the action (deploy:list, deploy:read, deploy:write, deploy:delete, deploy:logs) on this App
apps not configured	App management is not enabled in this cluster

Errors returned by the API are displayed by their message alone; with -v, the method and URL called are added in parentheses.

See also

• Operations
• App reference
• sng CLI: global flags and desired-state commands